On Tuesday, April 22, 2025 12:30:01 PM Eastern Daylight Time Paul Moore wrote: > On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <[email protected]> > wrote: > > On 2025-04-11 14:23, Paul Moore wrote: > > > > > On Mar 17, 2025 Richard Guy Briggs <[email protected]> wrote: > > > ... > > > > > > diff --git a/kernel/module/main.c b/kernel/module/main.c > > > > index 1fb9ad289a6f..efa62ace1b23 100644 > > > > --- a/kernel/module/main.c > > > > +++ b/kernel/module/main.c > > > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, > > > > const char __user *uargs, > > > > > > > > > > > > > > > module_allocated = true; > > > > > > > > > > > > > > > > - audit_log_kern_module(mod->name); > > > > + audit_log_kern_module(info->name); > > > > > > > > > > > > > > > > /* Reserve our place in the list. */ > > > > err = add_unformed_module(mod); > > > > > > > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, > > > > const char __user *uargs, > > > > > > > * failures once the proper module was allocated and > > > > * before that. > > > > */ > > > > > > > > - if (!module_allocated) > > > > + if (!module_allocated) { > > > > + audit_log_kern_module(info->name ? info->name : > > > > "(unavailable)"); > > > > > In keeping with audit tradition, wouldn't we want this to be "?" > > > instead of "(unavailable)"? > > Any comment on the above? This is more important than the non-public link > ...
It would save some disk space and stay similar to all other events. I also think it should be "?". -Steve > > > > mod_stat_bump_becoming(info, flags); > > > > > > > > + } > > > > > > > > free_copy(info, flags); > > > > return err; > > > > > > > > } > > > > > > > > -- > > > > 2.43.5 > > > -- > paul-moore.com > _______________________________________________ > Linux-audit mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ Linux-audit mailing list -- [email protected] To unsubscribe send an email to [email protected]
